I have a Sitecore 8.1 Update-3 solution. We have some simple ASPX files that we are trying to use as part of a Facebook application. Apparently the Facebook application displays the pages in an iFrame. And apparently somehow our pages are getting the X-Frame-Options: SAMEORIGIN header added to the response. I cannot figure out where that is coming from. And because of that header these pages cannot be displayed in a Facebook iFrame.

Does anyone know why this is happening? Is this a Sitecore issue? Or is it something deep in IIS or the machine config or something? It is driving me crazy. I have been able to go in to IIS and add a second X-Frame-Options header with the value of "ALLOW_FROM https://facebook.com". But that doesn't solve the problem. That just creates 2 headers and it still won't display the page in an iFrame.

I can't figure out if this is a Sitecore problem or an IIS problem.

  • Answer is in this question: sitecore.stackexchange.com/questions/1448/….. not sure if that makes it a duplicate.
    – Gatogordo
    Commented Dec 14, 2016 at 22:03
  • Yes I saw that. It is a similar question. But I am trying to remove the header, not just change its value. Commented Dec 15, 2016 at 13:42
  • Just remove the module from the web.config.. (but if you get a security audit they probably will tell you to put something back)
    – Gatogordo
    Commented Dec 15, 2016 at 13:46
  • Something worth noting is even putting the ALLOW_FROM header might not work in all browsers. The simple presence of the X-Frame-Options header is enough to trigger it to only do SAMEORIGIN Commented Feb 15, 2017 at 3:14

1 Answer 1


It's added by an HttpModule. In the system.webServer/modules section of the web.config.

<add type="Sitecore.Web.XFrameOptionsHeaderModule, Sitecore.Kernel" name="SitecoreXFrameOptionsHeaderModule" />

Interestingly, this is appears to be new to 8.1 update 3, but it is not mentioned in the release notes.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.